Challenging and hopeful edition of the Cyber Security Challenge

‘We've been one of the main sponsors of the Cyber Security Challenge for a number of years,’ says Kristof Tuyteleers, security officer at DNS Belgium. ‘Together with the colleagues of Engineering, every year we come up with a number of puzzles and a challenge for the final. We do that for two reasons. First of all, we want to introduce DNS Belgium to students and let them know that we offer internships to both Bachelor and Master student and supervise dissertations.’

‘Secondly, we've realised that DNS and DNS security are no longer a priority at schools. As a result, students have no idea how DNS works, nor can they assess how important it is in the security of systems. The CSC is a great opportunity to address this,’ according to Kristof.

Party hats and knitting wool

The puzzles and questions in the preliminary rounds are designed to make participants aware of what you can do (wrong) with DNS. In the finals, Kristof likes to go a step further and take the future cyber experts out of their comfort zone. This year, we asked students to illustrate how DNS works. Party hats with flags represented the different roles of DNS servers.

In the first scenario a new website was created. Colleague Arnaud acted as the web server , and Kristof was the client. The students were then given the zone file configuration of a fictitious domain name and had to determine themselves which DNS server roles were required for the information to flow from Arnaud to Kristof.

‘We created 11 server roles, even fictitious and useless ones, to add to the challenge,’ says Kristof. ‘The students had to use a ball of wool to make the right connections between the servers.  The same question was asked in a second scenario, but the finalists had to take into account a hack at the registry that had changed all the nameserver records. In a third scenario, the ISP was hacked and all DNS name server records were changed.’

This wasn't the easiest question to solve within 20 minutes it turned out. Only four of the 25 students managed to find a correct solution for the three scenarios.

‘The students expect an exercise on the computer,’ explains Kristof. ‘But I always try to come up with an analogue question that goes beyond encoding and analysing. In addition to technical skills, communication and collaboration are becoming increasingly important. Because we're physically present during the challenge, we're able to observe the interaction within the team and with us. It's very interesting to see how the teams work together.’

In the five years that DNS Belgium has sponsored the CSC, Kristof sees a positive evolution in that area. ‘Not necessarily in terms of technical knowledge, but in other important skills. Students seek more interaction, they're more articulate, they present themselves well and communicate fluently. These skills are becoming increasingly important. We live in a world where you have to be able to sell yourself. You may be the greatest cybersecurity expert, but if nobody knows who you are, you're not going to find a job.’

Mission accomplished

‘The response of the students was very positive. They came to tell us afterwards how much they enjoyed the competition or to ask for the solution,’ Kristof says with satisfaction. ‘If the intention was to make sure that finalists never forget how DNS works, it's mission accomplished.’

At the end of the final, participants were allowed to vote for the exercise they enjoyed most. DNS Belgium's challenge came second, after the exercise devised by the Belgian Army: a fictitious ballistic missile attack in the Army's digital war room. Our ball of wool couldn't compete with that,’ laughs Kristof.

DNS Belgium takes many initiatives to increase awareness of online security, targeting specific groups every time. An initiative like the CSC is the perfect way to reach future engineers.

‘It is also important for us to use initiatives like this to give students an idea of who DNS Belgium is as an organisation. That it's okay to have a laugh from time to time - even though we're working on serious and complex issues - and that our work is important but we don't always take ourselves seriously. From an employer branding point of view, that's invaluable.’